CVE-2025-32432

Craft CMS allows remote attackers to execute arbitrary code via a code injection vulnerability.

Craft CMS contains a critical code injection vulnerability enabling remote code execution, which poses a severe risk to DIB organizations relying on this CMS for content management systems. The vulnerability is actively exploited in the wild, necessitating immediate patching and review of all Craft CMS deployments to prevent unauthorized access and data exfiltration.

Shame score — Active exploitation of a critical RCE vulnerability in a widely-used CMS indicates significant security oversight and potential negligence in patch management.